Ind. Code » Title 16
Indiana Code

Ind. Code § 16-39-5-3 (2026)

Provider's use of records; confidentiality; violations

✓ current as of May 2026
Find cases: SyfertCases citing this section JustiaInd. Code CornellLII Search CasesGoogle Scholar

     Sec. 3. (a) As used in this section, "association" refers to an Indiana hospital trade association founded in 1921.

     (b) As used in this section, "data aggregation" means a combination of information obtained from the health records of a provider with information obtained from the health records of one (1) or more other providers to permit data analysis that relates to the health care operations of the providers.

     (c) Except as provided in IC 16-39-4-5, the original health record of the patient is the property of the provider and as such may be used by the provider without specific written authorization for legitimate business purposes, including the following:

(1) Submission of claims for payment from third parties.

(2) Collection of accounts.

(3) Litigation defense.

(4) Quality assurance.

(5) Peer review.

(6) Scientific, statistical, and educational purposes.

     (d) In use under subsection (c), the provider shall at all times protect the confidentiality of the health record and may disclose the identity of the patient only when disclosure is essential to the provider's business use or to quality assurance and peer review.

     (e) A provider or the Indiana archives and records administration may disclose a health record to another provider or to a nonprofit research organization to be used in connection with a scientific, statistical, or educational project. Each party that receives information from a health record in connection with the joint project shall protect the confidentiality of the health record and may not disclose the patient's identity except as allowed under this article.

     (f) A provider may disclose a health record or information obtained from a health record to the association for use in connection with a data aggregation project undertaken by the association. However, the provider may disclose the identity of a patient to the association only when the disclosure is essential to the project. The association may disclose the information it receives from a provider under this subsection to the state department to be used in connection with a public health activity or data aggregation of inpatient and outpatient discharge information submitted under IC 16-21-6-6. The information disclosed by:

(1) a provider to the association; or

(2) the association to the state department;

under this subsection is confidential.

     (g) Information contained in final results obtained by the state department for a public health activity that:

(1) is based on information disclosed under subsection (f); and

(2) identifies or could be used to determine the identity of a patient;

is confidential. All other information contained in the final results is not confidential.

     (h) Information that is:

(1) advisory or deliberative material of a speculative nature; or

(2) an expression of opinion;

including preliminary reports produced in connection with a public health activity using information disclosed under subsection (f), is confidential and may only be disclosed by the state department to the association and to the provider who disclosed the information to the association.

     (i) The association shall, upon the request of a provider that contracts with the association to perform data aggregation, make available information contained in the final results of data aggregation activities performed by the association in compliance with subsection (f).

     (j) A person who recklessly violates or fails to comply with subsections (e) through (h) commits a Class C infraction. Each day a violation continues constitutes a separate offense.

     (k) This chapter does not do any of the following:

(1) Repeal, modify, or amend any statute requiring or authorizing the disclosure of information about any person.

(2) Prevent disclosure or confirmation of information about patients involved in incidents that are reported or required to be reported to governmental agencies and not required to be kept confidential by the governmental agencies.

[Pre-1993 Recodification Citation: 16-4-8-8.]

As added by P.L.2-1993, SEC.22. Amended by P.L.102-1994, SEC.7; P.L.103-1994, SEC.1; P.L.2-1995, SEC.73; P.L.231-1999, SEC.15; P.L.44-2002, SEC.5; P.L.78-2004, SEC.23; P.L.45-2020, SEC.9.

 

Notes of Decisions
Cited in 4 cases (1 in the last 5 years), 1997–2025 · leading case: Doe v. Methodist Hosp., 690 N.E.2d 681 (Ind. 1997).
Sort: Relevance Newest Treatment
Doe v. Methodist Hosp., 690 N.E.2d 681 (Ind. 1997). · cites it 2× “) [4] Doe also sued Methodist Hospital and Lizzie Cameron for invasion of privacy and for violating statutory duties of confidentiality, see Ind.Code Ann. § 16-39-5-3(b) (West 1995) (formerly § 16-4-8-8; recodified 1993) (confidentiality of medical records); Ind.”
Indiana State Health Comm'r v. Caitlin Bernard, M.D. (Ind. Ct. App. 2025). · cites it 2× “, I.C. § 16-39-5-3(c)-(d) (imposing duties on medical providers to keep patients’ identities confidential when releasing patients’ health records to third parties); Henry v.”
Cmty. Health Network, Inc. v. Heather McKenzie & Daniel McKenzie, individually & as parents & Nat. guardians of J.M. & O.M., John McKenzie, Deborah West, Michael West, & Katrina Gray (Ind. Ct. App. 2020). “[49] Turning to the first element of negligence, duty, Community begins by arguing, correctly, that neither HIPAA nor INDIANA CODE § 16-39-5-3, as relied upon Court of Appeals of Indiana | Opinion 19A-CT-873 | May 26, 2020 Page 28 of 33 by the trial court, provide private rights…”
John Doe v. Methodist Hosp., etal (Ind. 1998). · cites it 2× “) 4: Doe also sued Methodist Hospital and Lizzie Cameron for invasion of privacy and for violating statutory duties of confidentiality, see Ind. Code Ann. § 16-39-5-3 (b) (West 1995) (formerly § 16-4-8-8; recodified 1993) (confidentiality of medical records); Ind.”
Ind. Code § 16-39-5-3(b): 1 case
Doe v. Methodist Hosp., 690 N.E.2d 681 (Ind. 1997). “) [4] Doe also sued Methodist Hospital and Lizzie Cameron for invasion of privacy and for violating statutory duties of confidentiality, see Ind.Code Ann. § 16-39-5-3(b) (West 1995) (formerly § 16-4-8-8; recodified 1993) (confidentiality of medical records); Ind.”
Ind. Code § 16-39-5-3(c): 1 case
Indiana State Health Comm'r v. Caitlin Bernard, M.D. (Ind. Ct. App. 2025). “, I.C. § 16-39-5-3(c)-(d) (imposing duties on medical providers to keep patients’ identities confidential when releasing patients’ health records to third parties); Henry v.”
Annotations are extracted automatically from the opinions in the Syfert caselaw corpus and ranked by authority, recency, and treatment. Dots show Syfertize treatment of the citing case itself.